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Abstract. In a secret sharing scheme, shares of a secret arc dis- 
tributed to participants in such a way that only certain predeter- 
mined sets of participants are qualified to reconstruct the secret. 
An access structure on a set of participants specifies which sets 
arc to be qualified. The information rate of an access structure 
is a bound on how efficient a secret sharing scheme for that ac- 
cess structure can be. Martf-Farre and Padro showed that all ac- 
cess structures with information rate greater than | are matroid- 
related, and Stinson showed that four of the minor-minimal, non- 
matroid-related access structures have information rate exactly |. 
By a result of Seymour, there are infinitely many remaining minor- 
minimal, non-matroid-related access structures. These are of the 
form r„ for n > 4 , where 

r„ = {{fc,_p,}|l <i <n}U {{pi, . . . ,p„}} 

is the access structure on a king and n pawns. In this paper we 
find the exact information rates for all r„, n > 2, thus making 
known the information rates for all minimal non-matroid-related 
access structures. 



1. Background and Motivation 

Our treatment of secret sharing follows that of Csirmaz [2] and Martf- 
Farre and Padro [3]. Let P be a set of participants, among whom we 
would like to share a secret. An access structure F on P is the collection 
of all subsets of P that are qualified, i.e., allowed to reconstruct the se- 
cret. An access structure F is fully determined by its minimal qualified 
subsets, which are those qualified sets for which no proper subset is 
qualified. Any subset of P not in F is called unqualified. We assume 
that each participant in P belongs to some minimal qualified subset. 

Intuitively, a secret sharing scheme for F is a way of taking a secret 
and using it to assign one or more shares to each participant in such a 
way that qualified sets are able to reconstruct the secret by combining 
their shares, while unqualified sets cannot learn any information about 
the value of the secret. 
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More precisely, let S be a collection of random variables consisting 
of one for the secret and one for each participant in P. We use S to 
denote both the secret and its associated random variable. For any 
participant x G P, we use H{x) to denote the Shannon entropy of the 
corresponding random variable, and for any subset X C P U {S"}, we 
use H{X) to denote the joint entropy of the random variables for all 
elements of X. We use H{X\Y) similarly for conditional entropy when 

x,r c pu {^}. 

We call S a (perfect) secret sharing scheme for T if it has the follow- 
ing properties: 

• If X G r then H{S\X) = 0, that is, the participants in X are 
able to combine their shares to completely determine the value 
of the secret. 

• li X ^ r then H{S\X) = H{S), that is, the uncertainty about 
the secret does not change even when all participants in X pool 
their shares. 

One measure of the efficiency of a secret sharing scheme is its infor- 
mation rate. Given a secret sharing scheme S and a participant x G P, 
the information rate of x is defined by 

HiS) 
H[x) 

The information rate of S, p(S), is the minimum information rate over 
all participants in P. For an access structure F, the information rate 
p(F) is the supremum of p(S) over all S that are secret sharing schemes 
for F. 

The information rate of a participant, secret sharing scheme, or ac- 
cess structure must always be less than or equal to one [2] . It has been 
shown that all access structures with information rate greater than | 
are matroid-related. For this result, as well as a definition and further 
details about matroid-related access structures, we refer the reader to 
Marti- Farre and Padro [3]. 

An interesting class of access structures that are not matroid-related 
are the king and n pawns access structures F„ for n > 3. F„ is defined 
on the set of participants P„ = {k,pi, . . . ,p„,} by 

F„ = {{k,pi}\l <i <n}U {{pi, . . . ,p„}}. 

In F„ the king and any one pawn may reconstruct the secret, as may 
the set of all pawns. However, the king may not reconstruct the secret 
alone, nor may any proper subset of the pawns. 

Seymour [1] showed that the minor-minimal access structures that 
are non-matroid-related are {Tn}n>3 along with {{a, b}, {b, c}, {c, d}}, 
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{{a,b},{a,c},{a,d},{b,c}}, and {{a, 6}, {a, c}, {6, c, c/}}. Stinson [6] 
demonstrated that these last three access structures, as well as T^, all 
have information rates of |. To the best of the author's knowledge, 
the information rates of the structures r„ have not been determined 
for general n. In this paper we remedy this, by finding the exact 
information rates for all structures in the infinite class {Tn}n>2- 



2. Results 

Our main result is 
Theorem 1. For n > 2, 

We will prove this theorem by showing that is both an upper 
and a lower bound for the information rate of r„. 

While proving bounds on the information rate, we will use the nor- 
malized entropy function h, defined by 

for any subset X C P U {S}. Observe that for a singleton {x}, h{{x}) 
is the reciprocal of p(x). The function h has the following properties, 
proofs of which may be found in Csirmaz [2]: 

• /i(0) = 0. 

• Monotonicity: Fot X C Y C P U {S}, 

h{X) < h(Y). 

• Submodularity: For X,Y C P U {S}, 

h{X) + h{Y) > h{X nY) + h{X U Y). 

• +-Submodularity: For X, F G T but X n F ^ T, 

h{X) + h{Y) > h{X nY) + h{X U F) + 1. 

In order to prove the upper bound result, we first need a couple of 
lemmas. For the sake of readability we abbreviate h{{xi, . . . ,Xi}) by 
h{xi..Xi). 

Lemma 2. The function h satisfies 



h{kpi..pn-i) > h{pi) + (n - 1). 
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Proof. For any i in the range 2 < i < n, we have {pi, . . . ,p„} G F, 
{/c,Pi, . . . . . . e F, and {pi, . . . . . . ^ F 

(interpreting Pri+i, . . . as an empty sequence). By +-submodularity 
this produces the inequahty 

h{pi..pn) + h{kpi..pi_iPi+i..Pn) > h{pi..pi_iPi+i..Pn) + h{kpi..Pn) + 1- 

Adding the submodular inequahty 

h{pi..pi) + h{pi..pi_ipi+i..pn) > h{pi..pn) + h{pi..pi_i) 

gives us 

(1) h{kpi..pi^ipi+i..pn) + h{pi..pi) > h{kpi..pn) + h{pi..pi^i) + 1. 
Summing ([T]) over 2 < i < ?i, we get 

n n 

^ h{kpi..pi_ipi+i..pn) + ^ h{pi..pi) > 

1=2 i=2 

n-1 

{n - l)h{kpi..pn) + ^ h{pi..pi) + {n- 1). 

We now add the monotonicities h{kpi..pn) > h{kpi..pi_ipi+i..pn) for 
2 < 2 < n — 1 (not n) and h{kpi..pn) > h{pi..pn)- Cancelhng terms 
gives us the desired result. □ 

Lemma 3. The function h satisfies the inequality 

n-1 

h{kpi) + h{p,) > h{kpi..pn-i) + in-2). 

i=2 

Proof. For any i in the range 2 < ? < n — 1, we have {kpi} G F, 
{kpi} G F, and {k} ^ F. By +-submodularity this produces the in- 
equahty 

h{kpi) + h{kpi) > h{kpipi) + h{k) + 1. 
Adding this to the submodular inequahties 

h{k) + h{pi) > h{kpi) 

and 

h{kpi..pi_i) + h{kpipi) > h{kpi..pi) + h{kpi) 

gives us 

(2) h{kpi..pi.i) + /i(pi) > h{kpi..pi) + 1. 
Summing ([2]) over 2<?<n — 1, we get 

n— 2 n— 1 n— 1 

h{kpi..pi) + Y KPi) > Y ^(^P^-Pi) + ('^ - 2) 
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which simphfies to the desired result. □ 

Theorem 4. For the king and n-pawn access structure Tn 

N n — 1 
'^^ ^ - 2n-3 
Proof. From Lemma [2] we have 

h{kpi..pn^i) > h{pi) + (n - 1) 
and from Lemma [3] we have 

n-1 

h{kpi) + ^h{pi) > h{kpi..pn-i) + {n-2). 

i=2 

We add to these inequahties the submodularity 

h{pi) + h{k) > h{kpi) 



to obtain 



Since 



n-1 



h{k) + J2h{Pi) > (2n-3). 



n-1 

^(^) + 2^ ^(Pi) ^ ('^ ~ 1) laax h{p) 

p6{A;,p2..Pn-i} 

at least one participant p must satisfy h{ji) > ^3^; equivalently, 
p{p) < ^^Iz^- Thus any secret sharing scheme for must have infor- 
mation rate at most and we conclude p(F„) < ^3^- □ 

Next we prove the lower bound result. By the definition of informa- 
tion rate for an access structure, it is sufficient to construct a secret 
sharing scheme S for F„ realizing p(S) = -^z^. We will begin by ex- 
hibiting two schemes for F„, Si and S2, neither of which will attain the 
desired information rate. We will then take S to be a suitable weighted 
average of Si and S2. 

For the constructions of Si and S2 we assume the secret, s, is selected 
from the finite field Zg where g is a prime greater than (2n— 1). Without 
loss of generality we may assume the secret is chosen with the uniform 
distribution p. 

For the scheme Si we take a variant of an (n, 2n — 1) threshold 
scheme from [5], which we describe here. To share the secret s we 
choose uniformly at random a polynomial f{x) over of degree at 
most n — 1 with /(O) = s. The king then receives as his Si-share the 
values /(I), /(2), . . . , f{n — 1), and each pj for 1 < i < n receives the 
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value f{n — 1 + i). That Si is indeed a secret sharing scheme for r„ 
follows from the discussion of threshold schemes in [3] . 

Lemma 5. Each participant's J^i-share will occur with uniform distri- 
bution over the appropriate domain. 

Proof. First, we observe that any n equations of the form /(xi) = yi 
,. . . , f{xn) = Vn for distinct values satisfied by exactly 

one polynomial / of degree at most n — 1. For m < n such equations 
f{xi) = 1/1, ... , f{xm) = Vm, there will be exactly g*^"™ polynomials 
that satisfy the set of equations. To see this, fix Xm+i, ■ ■ ■ ,Xn distinct 
from each other and from the first m values of x. There are q"'-"^ ways 
to choose values ym+i, ■ ■ ■ ,yn ^ '^q, and each choice of values will yield 
a unique polynomial. 

We also observe that since the secret s was chosen uniformly, and 
the polynomial / of degree at most n — 1 was chosen uniformly given 
the constraint /(O) = s, it follows that all polynomials / over Zg of 
degree at most n — 1 are equally likely to be used in Si. 

From the above observations, we see that any possible {n — l)-tuple 
of values for the king will be realized by q distinct polynomials. Since 
each polynomial is equally likely, the king's Si-share will be uniformly 
distributed over Z^"^. Similarly, any pawn's share will be realized by 
q^~^ distinct polynomials, each equally likely, and so a pawn's share 
will be uniformly distributed over Zg. □ 

The scheme S2 is created using the decomposition method [6], but 
the resulting scheme is simple enough to describe directly. We use a 
(2, 2) threshold scheme and an (n, n) threshold scheme, also discussed 
in [B]. For the (2, 2) threshold scheme, we distribute shares to members 
of the minimal qualified sets {/c,pj} for 1 < z < n, giving the king a 
random share r G Zg, and giving each pawn the modular sum r + s. 
For the (n, n) threshold scheme, we distribute shares to members of the 
remaining minimal qualified set {pi, . . . ,p„} by giving random values 
Ti., 1 < i < n — 1 to the first n — 1 pawns, and giving to Pn the share 

n-l 
i=l 

The king's S2-share will be just his share from the (2, 2) scheme. A 
pawn's S2-share will consist of his shares from both the (2, 2) and (n, n) 
schemes. 

Any qualified set in F^ will be qualified in either the (2, 2) or the 
(n, n) threshold scheme, and so will be qualified under S2. Any set 
X d Pn not in F^ will not be qualified in either of the threshold schemes 
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being used for S2. If all random numbers are chosen independently and 
uniformly, X will be unqualified under S2. Furthermore, the S2 shares 
for the king and each pawn will be uniformly distributed over and 
(Z,)^, respectively. 

We are now ready to construct the scheme S, which will allow us to 
share a secret that consists of n — 1 secrets from Zg. To do this we 
share one secret over Si, and one secret over each of n — 2 copies of 
S2. We use uniformly and independently generated random numbers 
for each instantiation of a secret sharing scheme. 

Theorem 6. 

P(E) 



2n-3 

Proof. The king's E-share will consist of (n— l) + (n — 2) = 2n — 3 shares 
from Zg. By Lemma E] and the discussion regarding S2 any E-share for 
the king will be equally likely, and so 

H{S) log(g"-i) n-1 

p{k) 



H{k) log(g2"-3) 2n-3' 

Similarly, each pawn's S-share will consist of 1 + 2{n — 2) = 2n — 3 
shares from Z^, all possible E-shares having equal likelihood, and so 
we also have 

P^'^ = ^3- 

Thus 



p(S) = mm{p{k),p{p)} 



n — 1 
2n-3' 



□ 



Theorem 7. For the king and n-pawn access structure 

n — 1 



p(rn) > 



2n 



Proof. This follows immediately from Theorem [6] and the definition of 
information rate for an access structure. □ 

Proof of Theorem 1. Combining the bounds found in Theorems H] and 
[3, we conclude that 

n — 1 



'^^ ' 2n-3 



□ 
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